From 5d75ce87fa6998375525e794502bd1e419f24a5b Mon Sep 17 00:00:00 2001
From: Cindy Lin <9029396+cindylindeed@users.noreply.github.com>
Date: Fri, 14 Aug 2026 15:47:03 -0700
Subject: [PATCH] Add summary of properties to Security Considerations section
in draft-miller-sshm-composite-sigs.
---
draft-miller-sshm-composite-sigs.xml | 26 ++++++++++++++++++++++----
1 file changed, 22 insertions(+), 4 deletions(-)
diff --git a/draft-miller-sshm-composite-sigs.xml b/draft-miller-sshm-composite-sigs.xml
index 1abb403..e3f1e82 100644
--- a/draft-miller-sshm-composite-sigs.xml
+++ b/draft-miller-sshm-composite-sigs.xml
@@ -491,14 +491,32 @@
apply here.
- The security of this composite scheme depends on the strength of
- both component algorithms. An adversary must break both ML-DSA
- and the Elliptic Curve algorithm to forge a signature.
+ The security of this composite scheme depends on the security of both
+ component algorithms. An adversary must forge both ML-DSA and Elliptic Curve
+ signatures in order to forge a composite signature.
Implementations MUST NOT reuse component key material between
composite and non-composite keys, or between multiple composite
- keys.
+ keys. See section 9.3.
+
+
+ If neither of the component algorithms are broken, both
+ ssh-mldsa44-ed25519 and ssh-mldsa87-p384 are Existentially Unforgeable under
+ Chosen-Message Attack (EUF-CMA), since ML-DSA, Ed25519, and ECDSA are all
+ EUF-CMA and SHA-512 is collision-resistant. If one of the component
+ algorithms are broken. See
+ section 9.2.1.
+
+
+ This composite scheme is not Strongly Unforgeable under Chosen-Message
+ Attack (SUF-CMA). Systems that rely on this property SHOULD NOT use this
+ scheme.
+
+
+ This composite scheme provides Weak Non-Separability (WNS) for both
+ components due to evidence of the composite in the Prefix in `M'`. See
+ section 9.2.3.